SponsorLink Integration Makes Moq Unuasable due to PII and GDPR Requirements

[bleepzter]

Based on the comments of DinglDanglBob in the r/dotnet channel - it seems like "starting from version 4.20, does include a .NET analyzer that scans your local git config on build, gets your email address and sends it to some service hosted in Azure to check whether or not you're a sponsor."

This is unacceptable for medical, scientific, and financial organizations that work with PII (Personally Identifiable Information) and payment information and are regulated under PCI DSS, HIPPA, CCPA, or GDPR.

[bleepzter]

It was closed long ago, but it still removes the library from the list of acceptable use OSS due to this issue. It can no longer be trusted.

[zarlo]

okay and what is your point making this issue?

[Laurianti]

6f3cf62

Has this change been released?

[kzu]

[Laurianti]

Yes, it's finally resolved. Unlike v4.20.69, the issue is fixed in v4.20.70, which was released on November 28.

[edproton]

After the widespread adoption of NSubstitute, it became clear that efforts to monetize a popular and community-supported open source library could contribute to its decline. In essence, NSubstitute has now become the go-to choice for companies.

[Laurianti]

After the widespread adoption of NSubstitute, it became clear that efforts to monetize a popular and community-supported open source library could contribute to its decline. In essence, NSubstitute has now become the go-to choice for companies.

Why do you say this? Hasn't the issue been resolved? Are there still reasons not to use Moq today?

[MichaMican]

@Laurianti - it is not gone for good - it was first removed due to moq breaking on MacOS -> #1375

Also the big Discussion thread (#1374) doesn't change in a commitive end that this will not happen again. They just want to "find a better way" to do it with (hopefully) the feedback from the poll (#1414)

Even though it's fine now - there is no clear commitment of ditching the SponsorLink concept and only time will tell when and how it will return

[kzu]

It will not come back with any PII or GDPR issues. Please read about the new approach and provide feedback at devlooped/SponsorLink#100